Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 268643 (CVE-2009-1956)

Summary: <dev-libs/apr-util-1.3.5: Off-by-one in apr_brigade_vprintf() (CVE-2009-1956)
Product: Gentoo Security Reporter: Duncan Exon Smith <duncanphilipnorman>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: apache-bugs
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://svn.apache.org/viewvc?view=rev&revision=768417
Whiteboard: B3 [glsa]
Package list:
Runtime testing required: ---
Bug Depends on: 272260    
Bug Blocks:    
Attachments:
Description Flags
Patch to remove an unnessary null terminator that causes a buffer overflow. none

Description Duncan Exon Smith 2009-05-04 17:47:27 UTC
I have 'svnsync' failing with the following message:
 svnsync: Got unexpected element svn::open_directory

The next revision to commit has a lot of property changes.  A google turned up the following threads, pointing to a problem with dev-libs/apr-util
 http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&viewType=browseAll&dsMessageId=1897250
 http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&viewType=browseAll&dsMessageId=1745697
The folks at CollabNet committed the following to the 'apr' trunk:
 http://svn.apache.org/viewvc/apr/apr/trunk/buckets/apr_brigade.c?r1=768417&r2=768416&pathrev=768417

Installing 'dev-libs/apr-util-1.3.4' with a patch for the above changeset and 'rc-config restart apache2' fixes the problem for me.

Reproducible: Always
Comment 1 Duncan Exon Smith 2009-05-04 17:51:05 UTC
Created attachment 190333 [details, diff]
Patch to remove an unnessary null terminator that causes a buffer overflow.

Here is the patch I applied locally.  It's the same as the following commit to the apr trunk:
 http://svn.apache.org/viewvc/apr/apr/trunk/buckets/apr_brigade.c?r1=768417&r2=768416&pathrev=768417
Comment 2 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2009-06-06 20:29:09 UTC
dev-libs/apr-1.3.5 was released on 2009-06-05.
dev-libs/apr-util-1.3.7 was released on 2009-06-05.
Comment 3 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-06 20:51:41 UTC
======================================================
Name: CVE-2009-1956
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956

Off-by-one error in the apr_brigade_vprintf function in Apache
APR-util before 1.3.5 on big-endian platforms allows remote attackers
to obtain sensitive information or cause a denial of service
(application crash) via crafted input.
Comment 4 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2009-06-08 21:14:00 UTC
dev-libs/apr-1.3.5 and dev-libs/apr-util-1.3.7 are now in the tree.
Comment 5 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-26 08:48:58 UTC
GLSA together with bug 272260.
Comment 6 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-07-04 07:49:31 UTC
GLSA 200907-03